CVE-2024-45662: IBM Safer Payments DoS Vulnerability

CVE-2024-45662 Overview

CVE-2024-45662 affects IBM Safer Payments, a fraud prevention platform used by financial institutions to identify and block fraudulent transactions in real time. The vulnerability allows a remote unauthenticated attacker to cause a denial of service through improper allocation of resources [CWE-770]. Affected releases span versions 6.4.0.00 through 6.4.2.07, 6.5.0.00 through 6.5.0.05, and 6.6.0.00 through 6.6.0.03. IBM addressed the issue and published remediation guidance in its support advisory.

Critical Impact
A network-based attacker can exhaust server resources without authentication or user interaction, disrupting transaction fraud screening operations.

Affected Products

IBM Safer Payments 6.4.0.00 through 6.4.2.07
IBM Safer Payments 6.5.0.00 through 6.5.0.05
IBM Safer Payments 6.6.0.00 through 6.6.0.03

Discovery Timeline

2025-01-18 - CVE-2024-45662 published to NVD
2025-08-14 - Last updated in NVD database

Technical Details for CVE-2024-45662

Vulnerability Analysis

The vulnerability is classified under [CWE-770]: Allocation of Resources Without Limits or Throttling. IBM Safer Payments fails to enforce limits on resources consumed during request processing. A remote attacker can submit crafted network traffic that triggers excessive allocation of memory, threads, or connection handles. Because the application does not throttle or bound these allocations, repeated requests drive the service into a degraded or unresponsive state.

The impact is restricted to availability. Confidentiality and integrity of fraud screening data are not affected by this flaw. However, an outage of Safer Payments directly disrupts real-time transaction scoring, which can force downstream payment systems into fail-open or fail-closed conditions depending on configuration.

Root Cause

The root cause is missing input throttling and resource quotas on a network-exposed code path. The application accepts and processes requests without imposing per-client or aggregate ceilings on resource usage. IBM has not disclosed the specific subsystem affected. Refer to the IBM Support Page for vendor technical details.

Attack Vector

Exploitation requires only network reachability to the Safer Payments service. No credentials, privileges, or user interaction are needed. An attacker sends a volume or sequence of requests engineered to maximize resource consumption per request. Sustained traffic exhausts the target's CPU, memory, or connection pool and halts legitimate fraud screening transactions. The EPSS score is 0.18%, reflecting low current exploitation probability but a viable attack path for adversaries targeting financial infrastructure.

Detection Methods for CVE-2024-45662

Indicators of Compromise

Sudden spikes in CPU, memory, or thread count on Safer Payments application servers without correlated transaction volume.
Elevated rates of connection timeouts, queue saturation, or dropped requests in Safer Payments logs.
Repeated requests from a single source IP or narrow IP range targeting Safer Payments network endpoints.
Increased latency or failures in downstream payment authorization workflows that depend on Safer Payments scoring.

Detection Strategies

Baseline normal request rates and resource utilization for Safer Payments, then alert on statistical deviations.
Inspect web application firewall and load balancer logs for unusual request patterns aimed at Safer Payments ports.
Correlate Safer Payments process health with network ingress metrics to identify resource exhaustion patterns.
Monitor application error logs for allocation failures, out-of-memory conditions, or thread pool rejections.

Monitoring Recommendations

Forward Safer Payments application, system, and network telemetry to a centralized SIEM or data lake for correlation.
Enable rate-limit alerting on perimeter devices fronting Safer Payments services.
Track service availability through synthetic transactions that exercise the fraud scoring API end to end.
Alert on connection count, memory utilization, and garbage collection metrics breaching defined thresholds.

How to Mitigate CVE-2024-45662

Immediate Actions Required

Identify all Safer Payments instances and confirm versions against the affected ranges 6.4.0.00–6.4.2.07, 6.5.0.00–6.5.0.05, and 6.6.0.00–6.6.0.03.
Apply the fixed release identified in the IBM advisory as soon as change windows permit.
Restrict network access to Safer Payments management and processing endpoints to known payment infrastructure.
Enable rate limiting and connection caps at the network perimeter ahead of Safer Payments servers.

Patch Information

IBM has published remediation guidance for CVE-2024-45662. Customers should consult the IBM Support Page for fixed versions and upgrade procedures. Upgrading to a patched release is the only complete remediation for this resource allocation flaw.

Workarounds

Place Safer Payments behind a reverse proxy or web application firewall that enforces request rate limits and concurrent connection caps.
Restrict source IPs allowed to reach Safer Payments to authenticated upstream payment systems only.
Tune operating system and application-level resource limits such as file descriptors, thread pools, and memory ceilings to fail fast under attack.
Implement health checks and automated service restart to recover availability if resource exhaustion occurs.

bash

# Example: rate limiting Safer Payments traffic with iptables
iptables -A INPUT -p tcp --dport 8443 -m state --state NEW \
  -m recent --set --name SAFERPAY
iptables -A INPUT -p tcp --dport 8443 -m state --state NEW \
  -m recent --update --seconds 10 --hitcount 20 \
  --name SAFERPAY -j DROP